A Model for When Disclosure Helps Security Peter P. Swire Ohio State University Stanford Cybersecurity Conference November 22, 2003

The Paradox Open Source mantra: No Security Through Obscurity Open Source mantra: No Security Through Obscurity Secrecy does not work Secrecy does not work Military base and the location of the defensive machine guns Military base and the location of the defensive machine guns Secrecy as essential Secrecy as essential I am working on a book on What Should Still Be Secret – basic model today I am working on a book on What Should Still Be Secret – basic model today

Open Source & Disclosure Helps Defenders Presume that attackers will easily/quickly learn of flaws Presume that attackers will easily/quickly learn of flaws Disclosure does not help attackers (much) Disclosure does not help attackers (much) Writers of software learn of flaws and fix Writers of software learn of flaws and fix Users of software learn of patch and fix Users of software learn of patch and fix Disclosure does help the defenders Disclosure does help the defenders [I am not taking a position on proprietary v. Open Source – focus on when disclosure can improve security] [I am not taking a position on proprietary v. Open Source – focus on when disclosure can improve security]

Military Base & Disclosure Helps Attackers It is hard for attackers to get close enough to learn the physical defenses It is hard for attackers to get close enough to learn the physical defenses Disclosure thus helps attackers Disclosure thus helps attackers The defenders likely get little benefit from outside/peer review broadcast to all The defenders likely get little benefit from outside/peer review broadcast to all Disclosure provides little help to defenders Disclosure provides little help to defenders

Effects of Disclosure Low Help Attackers High Open Source Military/Intelligence Help Defenders Low High

Physical & Cyber Security Defend the buried pipeline Defend the buried pipeline Hard for attackers to learn the key vulnerable point Hard for attackers to learn the key vulnerable point Expensive to rebuild pipeline once in place Expensive to rebuild pipeline once in place Vulnerabilities often unique Vulnerabilities often unique Change the software Change the software Easy for attackers to do remote attacks & tell others of vulnerability (warez & hacker sites) Easy for attackers to do remote attacks & tell others of vulnerability (warez & hacker sites) Relatively inexpensive to patch & update Relatively inexpensive to patch & update Vulnerabilities often large scale/mass market Vulnerabilities often large scale/mass market

Effects of Disclosure Low Help Attackers High Open Source Physical facilities 1. Military/ Intel 2. Physical facilities Help Defenders Low High

Conclusion I am proposing a simple model for when disclosure helps security I am proposing a simple model for when disclosure helps security Disclosure helps defenders? Attackers? Disclosure helps defenders? Attackers? Explains reasons for less disclosure of vulnerabilities for military, intel, & physical Explains reasons for less disclosure of vulnerabilities for military, intel, & physical Explains reasons for greater disclosure for many software and computer system settings Explains reasons for greater disclosure for many software and computer system settings Other reasons to consider disclosure or not Other reasons to consider disclosure or not FOIA/accountability FOIA/accountability Privacy/confidentiality Privacy/confidentiality Have an intellectual framework for proceeding Have an intellectual framework for proceeding